sugarcrm/sugarcrm_dev — Issue #60: Authentication function broken
Author: ajs
Created: 2011-12-02 21:17:24+00:00
State: open

I'm confused by the authenticateUser function in modules/Users/authentication/SugarAuthenticate/SugarAuthenticateUser.php, and the only thing I can figure that explains it is that this function must not be called. If it were, I can't see how it possibly works.

Why?

Because the passed in username ("$name") and password ("$password") are immediately overwritten with the DB name and password and then used in the SQL for looking up the user by those values. Unless a user's name happens to be the same as the DB name and their password happens to be the same as the login password for the DB, that's not going to work.

Now, I'm a PHP newbie, so please tell me if I'm reading this code wrong...